Beyond Configuration: Rethinking CI/CD With Code-Generated Pipelines
As CI/CD adoption grows, so does complexity. As companies grow, developers who don't stop to think about managing complexity eventually hit the wall: CI/CD pipelines that support dozens of use cases have become so intricate that changing them without breaking something turns into trial and error.
Pipelines must be run to be tested. With enough conditional logic, exhaustively testing every path becomes impossible. In an industry experience, one team I worked with maintained ~1,000 test projects they ran on a 24-runner farm that took a full day to execute, limiting them to one pipeline change per day. This is not the velocity DevOps has promised.
This talk introduces a different model: generating pipelines programmatically. By treating pipelines as a software engineering problem rather than YAML files, you can unit test pipeline logic, apply TDD, and use regression testing, all without running the CI engine.
I'll explore how we can implement pipeline generators on GitHub and GitLab, and explore "YAML-less" pipelines that drop the CI-engine dependency entirely, and connect this to the broader shift seen in tools like Pulumi and Dagger.
CI/CD pipelines start simple, but as organizations scale, they become sprawling YAML configurations. They become brittle, hard to test, and even harder to change. This is even the case in organizations when templates are used to manage complexity. This talk introduces a different approach: generating pipelines programmatically using a general-purpose programming language.
Rather than maintaining hand-written YAML files, a pipeline generator produces CI/CD configurations as an output, the same way a compiler translates source code to machine code. This makes pipeline logic unit-testable, enables Test-Driven Development and opens the door to regression testing without ever running the CI engine. The pipeline generator produces a CI/CD configurations solely from analyzing a software project. For example, the presence of a "pom.xml" file indicates the programming language, the build system and the presence of third-party dependencies.
This approach is part of a broader industry shift already visible in tools like Pulumi (infrastructure as code), Dagger (container builds without Dockerfiles) and Paketo Buildpacks. Real-world adoption in 2018 in a music streaming company has shown up to 2x gains in developer efficiency, with teams better equipped to respond to incidents like Log4Shell through enforced golden paths. This approach has been kept under wraps until now.
Attendees will leave with a concrete mental model and techniques for implementing pipeline generators on GitHub and GitLab, and their own system which doesn't use YAML at all. Attendees will be left with a new perspective where CI/CD is treated as a software engineering discipline.
Alexandre-Xavier Labonté-Lamoureux is a passionate IT professional and DevSecOps advocate based in Montreal, with over eight years of experience spanning DevOps, system administration, and cybersecurity. At Arctiq, he helps organizations build secure, efficient software by advancing Application Security (AppSec), Developer Experience (DevEx), and Internal Developer Platforms. A long-time open-source advocate, he dedicated over six years to volunteering in technology and science clubs at his university, fostering a culture of curiosity and collaboration among like-minded students.
Deeply engaged in the cybersecurity community, Alexandre-Xavier has designed challenges for UnitedCTF, presented at Montréhack, and mentored Canadian student teams at international competitions including the European Cyber Security Challenge (ECSC) and the International Cybersecurity Challenge (ICC). His accolades include the Cybertalent award from École de Cybersécurité, wins at NorthSec and HackQc, and an OCTAS award for leading an innovative domotics project. A lifelong learner currently pursuing a Master's in Software Engineering at ÉTS with a focus on Internal Developer Platforms, Alexandre-Xavier holds knowledge sharing and developer experience at the core of everything he does.